High
LAPSUS$ Ransomware is a new and emerging ransomware group that has successfully attacked major conglomerate. Like most ransomware groups, LAPSUS$ also infiltrates organizations with a phishing attack. From there on, they exploit vulnerabilities like privilege escalation to get hold of administrative rights and blatantly display their abilities. LAPSUS$ Threat group has allegedly breached Okta. This news comes in the same week when the group announced their infiltration of Microsoft’s Azure DevOps. If the shared screenshots are true, then LAPSUS$ has access to Microsoft’s internal source-code repositories.
The gang has previously (allegedly) compromised NVIDIA, Samsung, Vodafone, Mercado Libre, and Ubisoft. They have also started a recruitement campaign for insiders employeed at conglomorates like Microsoft, Apple, and IBM.
Now, the LAPSUS$ group has shared screenshots that provide legitimacy to their claim that they have breached Okta.
Okta is an IDaaS (Identity as a Service) platform that is used to secure employee and customer identities. Big names like Hitachi, T-Mobile, HP, and Siemens use Okta. The worst part is, if the screenshots hsraed by LAPSUS$ are real, that means that the group breached Okta 2 months ago and has had access ever since.